unjwt 0.4.0 → 0.5.1

package/dist/shared/unjwt.CVKbKOFy.d.ts

@@ -0,0 +1,100 @@
+import { n as JWK_HMAC, o as JWK_RSA_SIGN, p as JWK_RSA_PSS, q as JWK_ECDSA, m as JWK } from './unjwt.CxhGjEAX.js';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.BISJ5yt1.js';
+
+type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
+/** JWS Signing Algorithm Identifier. */
+type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWS_SIGN_EXTRA;
+/** Recognized JWS Header Parameters, any other Header Members may also be present. */
+interface JWSHeaderParameters extends JoseHeaderParameters {
+    /** JWS "alg" (Algorithm) Header Parameter */
+    alg?: JWSAlgorithm;
+    /**
+     * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
+     * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
+     * If `false`, the payload is used directly without Base64URL encoding.
+     * Defaults to `true`.
+     */
+    b64?: boolean;
+}
+/** JWS Protected Header */
+interface JWSProtectedHeader extends JWSHeaderParameters {
+    alg: JWSAlgorithm;
+}
+/**
+ * JWS (JSON Web Signature) options for signing
+ */
+interface JWSSignOptions {
+    /** The JWS Algorithm to use. Must be provided. */
+    alg?: JWSAlgorithm;
+    /**
+     * Additional protected header parameters. `alg` is automatically included.
+     * `typ` defaults to "JWT" if not provided.
+     */
+    protectedHeader?: JWSHeaderParameters;
+}
+/** Result of JWS verification */
+interface JWSVerifyResult<T = JWTClaims | Uint8Array | string> {
+    /** The decoded and verified payload. */
+    payload: T;
+    /** The JWS Protected Header. */
+    protectedHeader: JWSProtectedHeader;
+}
+/** Options for JWS verification */
+interface JWSVerifyOptions {
+    /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
+    algorithms?: JWSAlgorithm[];
+    /** List of critical header parameters that must be understood and processed. */
+    critical?: string[];
+    /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
+    forceUint8Array?: boolean;
+}
+
+/**
+ * Creates a JWS (JSON Web Signature) in Compact Serialization format.
+ *
+ * @param payload The payload to sign. Can be a string, Uint8Array, or an object (which will be JSON stringified).
+ * @param key The signing key (CryptoKey, JWK, or raw symmetric key as Uint8Array).
+ * @param options Signing options, including the algorithm (`alg`) and protected header parameters.
+ * @returns A Promise resolving to the JWS Compact Serialization string.
+ */
+declare function sign(payload: JWTClaims, key: JWK | Uint8Array, options?: JWSSignOptions): Promise<string>;
+declare function sign(payload: string | Uint8Array | Record<string, any>, key: JWK | Uint8Array, options?: JWSSignOptions): Promise<string>;
+declare function sign(payload: JWTClaims, key: CryptoKey, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+declare function sign(payload: string | Uint8Array | Record<string, any>, key: CryptoKey, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+declare function sign(payload: string | Uint8Array | Record<string, any>, key: CryptoKey | JWK | Uint8Array, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+type KeyLookupFunction = (header: JWSProtectedHeader) => CryptoKey | JWK | Uint8Array | Promise<CryptoKey | JWK | Uint8Array>;
+/**
+ * Verifies a JWS (JSON Web Signature) in Compact Serialization format.
+ *
+ * @param jws The JWS Compact Serialization string.
+ * @param key The verification key (CryptoKey, JWK, raw symmetric key as Uint8Array, or a function resolving the key).
+ * @param options Verification options, such as allowed algorithms.
+ * @returns A Promise resolving to an object containing the verified payload and protected header.
+ * @throws If the JWS is invalid, signature verification fails, or options are not met.
+ */
+declare function verify<T = JWTClaims | Uint8Array | string>(jws: string, key: CryptoKey | JWK | Uint8Array | KeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
+declare function verify(jws: string, key: CryptoKey | JWK | Uint8Array | KeyLookupFunction, options: JWSVerifyOptions & {
+    forceUint8Array: true;
+}): Promise<JWSVerifyResult<Uint8Array>>;
+
+type jws_JWSAlgorithm = JWSAlgorithm;
+type jws_JWSHeaderParameters = JWSHeaderParameters;
+type jws_JWSProtectedHeader = JWSProtectedHeader;
+type jws_JWSSignOptions = JWSSignOptions;
+type jws_JWSVerifyOptions = JWSVerifyOptions;
+type jws_JWSVerifyResult<T = JWTClaims | Uint8Array | string> = JWSVerifyResult<T>;
+declare const jws_sign: typeof sign;
+declare const jws_verify: typeof verify;
+declare namespace jws {
+  export { jws_sign as sign, jws_verify as verify };
+  export type { jws_JWSAlgorithm as JWSAlgorithm, jws_JWSHeaderParameters as JWSHeaderParameters, jws_JWSProtectedHeader as JWSProtectedHeader, jws_JWSSignOptions as JWSSignOptions, jws_JWSVerifyOptions as JWSVerifyOptions, jws_JWSVerifyResult as JWSVerifyResult };
+}
+
+export { jws as j, sign as s, verify as v };
+export type { JWSAlgorithm as J, JWSHeaderParameters as a, JWSProtectedHeader as b, JWSSignOptions as c, JWSVerifyResult as d, JWSVerifyOptions as e };

package/dist/shared/unjwt.Cd9nTEWg.d.mts

@@ -0,0 +1,52 @@
+import { i as JWK_RSA_Public } from './unjwt.CxhGjEAX.mjs';
+
+/** Header Parameters common to JWE and JWS */
+interface JoseHeaderParameters {
+    /** "kid" (Key ID) Header Parameter */
+    kid?: string;
+    /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
+    x5t?: string;
+    /** "x5c" (X.509 Certificate Chain) Header Parameter */
+    x5c?: string[];
+    /** "x5u" (X.509 URL) Header Parameter */
+    x5u?: string;
+    /** "jku" (JWK Set URL) Header Parameter */
+    jku?: string;
+    /** "jwk" (JSON Web Key) Header Parameter */
+    jwk?: JWK_RSA_Public;
+    /** "typ" (Type) Header Parameter */
+    typ?: string;
+    /** "cty" (Content Type) Header Parameter */
+    cty?: string;
+    /** "crit" (Critical) Header Parameter */
+    crit?: string[];
+    /** Any other JWS/JWE Header member. */
+    [propName: string]: unknown;
+}
+interface JWTClaims {
+    /** "iss" (Issuer) Claim */
+    iss?: string;
+    /** "sub" (Subject) Claim */
+    sub?: string;
+    /** "aud" (Audience) Claim */
+    aud?: string | string[];
+    /** "exp" (Expiration Time) Claim */
+    exp?: number;
+    /** "nbf" (Not Before) Claim */
+    nbf?: number;
+    /** "iat" (Issued At) Claim */
+    iat?: number;
+    /** "jti" (JWT ID) Claim */
+    jti?: string;
+    /** Any other JWT member. */
+    [propName: string]: unknown;
+}
+interface JWT<T = JWTClaims> {
+    header: JoseHeaderParameters & {
+        /** "alg" (Algorithm) Header Parameter */
+        alg: string;
+    };
+    claims: T;
+}
+
+export type { JoseHeaderParameters as J, JWTClaims as a, JWT as b };

package/dist/shared/unjwt.Ce72NmIz.mjs

@@ -0,0 +1,453 @@
+import { a as checkEncCryptoKey, u as uint32be, g as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, b as bitLengthCEK, d as jwkTokey, i as importKey, f as generateIV, h as encrypt$1, l as unwrapKey, m as decrypt$1 } from './unjwt.1gbuWbc6.mjs';
+import { e as concatUint8Arrays, t as textEncoder, f as assertCryptoKey, b as base64UrlEncode, g as isCryptoKey, a as isJWK, d as base64UrlDecode, r as randomBytes, c as textDecoder } from './unjwt.DHdDAH0L.mjs';
+import { c as checkKeyLength } from './unjwt.C9Xhi7hE.mjs';
+
+function lengthAndInput(input) {
+  return concatUint8Arrays(uint32be(input.length), input);
+}
+async function concatKdf(secret, bits, value) {
+  const iterations = Math.ceil((bits >> 3) / 32);
+  const res = new Uint8Array(iterations * 32);
+  for (let iter = 0; iter < iterations; iter++) {
+    const buf = new Uint8Array(4 + secret.length + value.length);
+    buf.set(uint32be(iter + 1));
+    buf.set(secret, 4);
+    buf.set(value, 4 + secret.length);
+    res.set(await digest("sha256", buf), iter * 32);
+  }
+  return res.slice(0, bits >> 3);
+}
+async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
+  checkEncCryptoKey(publicKey, "ECDH");
+  checkEncCryptoKey(privateKey, "ECDH", "deriveBits");
+  const value = concatUint8Arrays(
+    lengthAndInput(textEncoder.encode(algorithm)),
+    lengthAndInput(apu),
+    lengthAndInput(apv),
+    uint32be(keyLength)
+  );
+  const length = publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(
+    Number.parseInt(
+      publicKey.algorithm.namedCurve.slice(-3),
+      10
+    ) / 8
+  ) << 3;
+  const sharedSecret = new Uint8Array(
+    await crypto.subtle.deriveBits(
+      {
+        name: publicKey.algorithm.name,
+        public: publicKey
+      },
+      privateKey,
+      length
+    )
+  );
+  return concatKdf(sharedSecret, keyLength, value);
+}
+function allowed(key) {
+  switch (key.algorithm.namedCurve) {
+    case "P-256":
+    case "P-384":
+    case "P-521": {
+      return true;
+    }
+    default: {
+      return key.algorithm.name === "X25519";
+    }
+  }
+}
+async function digest(algorithm, data) {
+  const subtleDigest = `SHA-${algorithm.slice(-3)}`;
+  return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
+}
+
+const subtleAlgorithm = (alg) => {
+  switch (alg) {
+    case "RSA-OAEP":
+    case "RSA-OAEP-256":
+    case "RSA-OAEP-384":
+    case "RSA-OAEP-512": {
+      return "RSA-OAEP";
+    }
+    default: {
+      throw new Error(
+        `alg ${alg} is not supported either by JOSE or your javascript runtime`
+      );
+    }
+  }
+};
+async function encryptRSAES(alg, key, cek) {
+  checkEncCryptoKey(key, alg, "encrypt");
+  checkKeyLength(alg, key);
+  return new Uint8Array(
+    await crypto.subtle.encrypt(subtleAlgorithm(alg), key, cek)
+  );
+}
+
+/**
+ * This is a fork of Jose library's utility functions.
+ * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/encrypt_key_management.ts
+ * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
+ */
+async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
+  let encryptedKey;
+  let parameters = {};
+  let cek;
+  switch (alg) {
+    case "dir": {
+      cek = key;
+      break;
+    }
+    case "ECDH-ES":
+    case "ECDH-ES+A128KW":
+    case "ECDH-ES+A192KW":
+    case "ECDH-ES+A256KW": {
+      assertCryptoKey(key);
+      if (!allowed(key)) {
+        throw new Error(
+          "ECDH with the provided key is not allowed or not supported by your javascript runtime"
+        );
+      }
+      const { apu, apv } = providedParameters;
+      const ephemeralKey = providedParameters.epk ? await normalizeKey(providedParameters.epk, alg) : (await crypto.subtle.generateKey(
+        key.algorithm,
+        true,
+        ["deriveBits"]
+      )).privateKey;
+      const { x, y, crv, kty } = await keyToJWK(ephemeralKey);
+      const sharedSecret = await deriveECDHESKey(
+        key,
+        ephemeralKey,
+        alg === "ECDH-ES" ? enc : alg,
+        alg === "ECDH-ES" ? bitLengthCEK(enc) : Number.parseInt(alg.slice(-5, -2), 10),
+        apu,
+        apv
+      );
+      parameters = { epk: { x, y, crv, kty } };
+      if (apu) parameters.apu = base64UrlEncode(apu);
+      if (apv) parameters.apv = base64UrlEncode(apv);
+      if (alg === "ECDH-ES") {
+        cek = sharedSecret;
+        break;
+      }
+      cek = providedCek || generateCEK(enc);
+      const kwAlg = alg.slice(-6);
+      encryptedKey = (await wrap(kwAlg, sharedSecret, cek)).encryptedKey;
+      break;
+    }
+    case "RSA-OAEP":
+    case "RSA-OAEP-256":
+    case "RSA-OAEP-384":
+    case "RSA-OAEP-512": {
+      cek = providedCek || generateCEK(enc);
+      assertCryptoKey(key);
+      encryptedKey = await encryptRSAES(alg, key, cek);
+      break;
+    }
+    case "PBES2-HS256+A128KW":
+    case "PBES2-HS384+A192KW":
+    case "PBES2-HS512+A256KW": {
+      cek = providedCek || generateCEK(enc);
+      const { p2c, p2s } = providedParameters;
+      ({ encryptedKey, ...parameters } = await wrap(alg, key, cek, p2c, p2s));
+      break;
+    }
+    case "A128KW":
+    case "A192KW":
+    case "A256KW": {
+      cek = providedCek || generateCEK(enc);
+      encryptedKey = (await wrap(alg, key, cek)).encryptedKey;
+      break;
+    }
+    case "A128GCMKW":
+    case "A192GCMKW":
+    case "A256GCMKW": {
+      cek = providedCek || generateCEK(enc);
+      const { iv } = providedParameters;
+      ({ encryptedKey, ...parameters } = await encryptIV(alg, key, cek, iv));
+      break;
+    }
+    default: {
+      throw new Error(
+        'Invalid or unsupported "alg" (JWE Algorithm) header value'
+      );
+    }
+  }
+  return { cek, encryptedKey, parameters };
+}
+async function normalizeKey(key, alg) {
+  if (key instanceof Uint8Array) {
+    return key;
+  }
+  if (isCryptoKey(key)) {
+    return key;
+  }
+  if (isJWK(key)) {
+    if ("k" in key && key.k) {
+      return base64UrlDecode(key.k, false);
+    }
+    return jwkTokey({ ...key, alg });
+  }
+  throw new Error("unreachable");
+}
+
+async function encrypt(payload, key, options = {}) {
+  const {
+    protectedHeader: additionalProtectedHeader,
+    cek: providedCek,
+    contentEncryptionIV: providedContentIV,
+    keyManagementIV,
+    p2s = randomBytes(16),
+    p2c = 2048,
+    ecdhPartyUInfo,
+    ecdhPartyVInfo
+  } = options;
+  let { alg, enc } = options;
+  if (!alg) {
+    if (typeof key === "string" || key instanceof Uint8Array) {
+      alg = "PBES2-HS256+A128KW";
+    } else if (isJWK(key)) {
+      alg = key.alg;
+    }
+  }
+  if (!alg) {
+    throw new TypeError(
+      'JWE "alg" (Key Management Algorithm) must be provided in options or inferable from the key'
+    );
+  }
+  if (!enc) {
+    enc = isJWK(key) && "enc" in key ? key.enc : "A128GCM";
+  }
+  const plaintextBytes = getPlaintextBytes(payload);
+  const jweKeyManagementParams = {};
+  if (keyManagementIV) jweKeyManagementParams.iv = keyManagementIV;
+  if (p2s) jweKeyManagementParams.p2s = p2s;
+  if (p2c) jweKeyManagementParams.p2c = p2c;
+  if (ecdhPartyUInfo) jweKeyManagementParams.apu = ecdhPartyUInfo;
+  if (ecdhPartyVInfo) jweKeyManagementParams.apv = ecdhPartyVInfo;
+  if (additionalProtectedHeader?.epk instanceof CryptoKey) {
+    jweKeyManagementParams.epk = additionalProtectedHeader.epk;
+  }
+  const wrappingKeyMaterial = await importKey(key, alg);
+  const {
+    cek: finalCek,
+    // This is the CEK (CryptoKey | Uint8Array) to be used for content encryption
+    encryptedKey: jweEncryptedKey,
+    // This is the JWE Encrypted Key (Uint8Array | undefined)
+    parameters: keyManagementHeaderParams
+    // JWE header params from key encryption (e.g., epk, p2s, iv, tag)
+  } = await encryptKey(
+    alg,
+    enc,
+    wrappingKeyMaterial,
+    providedCek,
+    jweKeyManagementParams
+  );
+  const baseProtectedHeader = { ...additionalProtectedHeader };
+  delete baseProtectedHeader.alg;
+  delete baseProtectedHeader.enc;
+  const jweProtectedHeader = {
+    ...baseProtectedHeader,
+    ...keyManagementHeaderParams,
+    alg,
+    enc
+  };
+  if (jweProtectedHeader.typ === void 0 && typeof payload === "object" && !(payload instanceof Uint8Array)) {
+    jweProtectedHeader.typ = "JWT";
+  }
+  if (jweProtectedHeader.typ === "JWT" && typeof payload === "object" && !(payload instanceof Uint8Array)) {
+    jweProtectedHeader.cty ||= "json";
+  }
+  const protectedHeaderSerialized = JSON.stringify(jweProtectedHeader);
+  const protectedHeaderEncoded = base64UrlEncode(protectedHeaderSerialized);
+  const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+  const contentIVBytes = providedContentIV ?? generateIV(enc);
+  const {
+    ciphertext: contentCiphertext,
+    tag: contentAuthTag,
+    iv: actualContentIV
+  } = await encrypt$1(
+    enc,
+    plaintextBytes,
+    finalCek,
+    contentIVBytes,
+    aadBytes
+  );
+  if (!actualContentIV) {
+    throw new Error("Content encryption IV was not generated or returned.");
+  }
+  if (!contentAuthTag) {
+    throw new Error(
+      "Content encryption auth tag was not generated or returned."
+    );
+  }
+  const encryptedKeyEncoded = jweEncryptedKey ? base64UrlEncode(jweEncryptedKey) : "";
+  const jweParts = [
+    protectedHeaderEncoded,
+    encryptedKeyEncoded,
+    base64UrlEncode(actualContentIV),
+    base64UrlEncode(contentCiphertext),
+    base64UrlEncode(contentAuthTag)
+  ];
+  return jweParts.join(".");
+}
+async function decrypt(jwe, key, options) {
+  const parts = jwe.split(".");
+  if (parts.length !== 5) {
+    throw new Error(
+      "Invalid JWE: Must contain five sections (RFC7516, section-3)."
+    );
+  }
+  const [
+    protectedHeaderEncoded,
+    encryptedKeyEncoded,
+    ivEncoded,
+    ciphertextEncoded,
+    authTagEncoded
+  ] = parts;
+  let protectedHeader;
+  try {
+    const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
+    protectedHeader = JSON.parse(protectedHeaderJson);
+  } catch (error_) {
+    throw new Error(
+      `Invalid JWE: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`
+    );
+  }
+  if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg || !protectedHeader.enc) {
+    throw new Error(
+      'Invalid JWE: Protected header must be an object with "alg" and "enc" properties.'
+    );
+  }
+  const alg = protectedHeader.alg;
+  const enc = protectedHeader.enc;
+  if (options?.algorithms && !options.algorithms.includes(alg)) {
+    throw new Error(`Key management algorithm not allowed: ${alg}`);
+  }
+  if (options?.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) {
+    throw new Error(`Content encryption algorithm not allowed: ${enc}`);
+  }
+  const resolvedKeyMaterial = typeof key === "function" ? await key(protectedHeader) : key;
+  const unwrappingKey = await importKey(resolvedKeyMaterial, alg);
+  const encryptedKeyBytes = base64UrlDecode(encryptedKeyEncoded, false);
+  const contentIVBytes = base64UrlDecode(ivEncoded, false);
+  const contentAuthTagBytes = base64UrlDecode(authTagEncoded, false);
+  const ciphertextBytes = base64UrlDecode(ciphertextEncoded, false);
+  const unwrapKeyOpts = {
+    iv: protectedHeader.iv,
+    tag: protectedHeader.tag,
+    p2s: protectedHeader.p2s,
+    p2c: protectedHeader.p2c,
+    epk: protectedHeader.epk,
+    apu: protectedHeader.apu,
+    apv: protectedHeader.apv,
+    unwrappedKeyAlgorithm: options?.unwrappedKeyAlgorithm,
+    keyUsage: options?.keyUsage,
+    extractable: options?.extractable,
+    returnAs: false
+    // Returning CEK as Uint8Array
+  };
+  const cekBytes = await unwrapKey(
+    alg,
+    encryptedKeyBytes,
+    unwrappingKey,
+    unwrapKeyOpts
+  );
+  const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+  const plaintextBytes = await decrypt$1(
+    enc,
+    cekBytes,
+    ciphertextBytes,
+    contentIVBytes,
+    contentAuthTagBytes,
+    aadBytes
+  );
+  let payload;
+  if (options?.forceUint8Array) {
+    payload = plaintextBytes;
+  } else {
+    const decodedString = textDecoder.decode(plaintextBytes);
+    const cty = protectedHeader.cty?.toLowerCase();
+    const isJsonOutput = protectedHeader.typ === "JWT" || cty === "json" || cty === "application/json" || cty && cty.endsWith("+json");
+    if (isJsonOutput) {
+      if (decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]")) {
+        try {
+          payload = JSON.parse(decodedString);
+        } catch {
+          payload = decodedString;
+        }
+      } else {
+        payload = decodedString;
+      }
+    } else {
+      payload = decodedString;
+    }
+  }
+  if (options?.critical && protectedHeader.crit) {
+    const understoodParams = /* @__PURE__ */ new Set([
+      ...options.critical || [],
+      // JWE specific standard headers:
+      "alg",
+      "enc",
+      "typ",
+      "cty",
+      "kid",
+      "jwk",
+      "jku",
+      "x5c",
+      "x5t",
+      "x5u",
+      "iv",
+      "tag",
+      "p2s",
+      "p2c",
+      "epk",
+      "apu",
+      "apv"
+    ]);
+    for (const critParam of protectedHeader.crit) {
+      if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) {
+        throw new Error(
+          `Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`
+        );
+      }
+      if (!understoodParams.has(critParam)) {
+        throw new Error(
+          `Critical header parameter not understood: ${critParam}`
+        );
+      }
+    }
+  } else if (!options?.critical && protectedHeader.crit) {
+    throw new Error(
+      `Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`
+    );
+  }
+  return {
+    payload,
+    protectedHeader,
+    cek: cekBytes,
+    aad: aadBytes
+  };
+}
+function getPlaintextBytes(payload) {
+  if (payload instanceof Uint8Array) {
+    return payload;
+  }
+  if (typeof payload === "string") {
+    return textEncoder.encode(payload);
+  }
+  if (typeof payload === "object" && payload !== null) {
+    return textEncoder.encode(JSON.stringify(payload));
+  }
+  throw new TypeError(
+    "Plaintext must be a string, Uint8Array, or a JSON-serializable object."
+  );
+}
+
+const jwe = {
+  __proto__: null,
+  decrypt: decrypt,
+  encrypt: encrypt
+};
+
+export { decrypt as d, encrypt as e, jwe as j };